Centralize relaxed JSON writer; add Format-path and label escaping tests

The relaxed-encoder JsonWriterOptions was defined twice (formatter and
serializer) with drifting comments, and each Utf8JsonWriter opted in per
construction site: a future writer that forgot the options argument would
silently revert to HTML-safe \uXXXX escaping with no compiler warning.

Extract a single Infrastructure.JsonWriterDefaults.createWriter as the one
way the sink builds a writer, so escaping cannot drift between sites. The
shared comment also corrects the description: the relaxed encoder still
escapes U+2028/U+2029 and DEL, so it is not "only what JSON mandates".

Add the two missing wire-format guards:
- the public LokiJsonTextFormatter.Format entry point (the sink fast path
  bypasses it, so its writer site had no test coverage);
- promoted label values (the envelope writer escapes label keys/values too).

The escaping tests sample neutral, multi-script non-ASCII (accented Latin
plus CJK) rather than a single script.

Author: mishamyte

src/Serilog.Sinks.Grafana.Loki/Infrastructure/JsonWriterDefaults.fs

@@ -0,0 +1,36 @@
+// Copyright 2020-2026 Mykhailo Shevchuk & Contributors
+//
+// Licensed under the MIT license;
+// you may not use this file except in compliance with the License.
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See LICENSE file in the project root for full license information.
+
+namespace Serilog.Sinks.Grafana.Loki.Infrastructure
+
+open System.Buffers
+open System.Text.Encodings.Web
+open System.Text.Json
+
+// Single source of truth for every Utf8JsonWriter the sink creates.
+//
+// The default Utf8JsonWriter encoder is HTML-safe and renders every '"', '<', '>', '&', '\'' and
+// all non-ASCII as \uXXXX, which makes the stored Loki log line unreadable. The relaxed encoder
+// escapes the JSON-mandatory set (quote, backslash, control chars) plus the line/paragraph
+// separators U+2028/U+2029 and DEL, and emits printable non-ASCII verbatim. Output stays valid
+// JSON (and valid UTF-8), so consumers are unaffected.
+//
+// Centralised behind createWriter so escaping cannot drift between writer sites: a writer built
+// the default way (`new Utf8JsonWriter(buffer)`) would silently re-introduce \uXXXX over part of
+// the payload, and no compiler warning catches the missing options argument.
+[<RequireQualifiedAccess>]
+module internal JsonWriterDefaults =
+
+    let relaxedOptions =
+        JsonWriterOptions(Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping)
+
+    /// Creates a Utf8JsonWriter over the buffer using the relaxed (readable) encoder.
+    let createWriter (buffer: PooledByteBufferWriter) =
+        new Utf8JsonWriter(buffer :> IBufferWriter<byte>, relaxedOptions)

src/Serilog.Sinks.Grafana.Loki/LokiJsonTextFormatter.fs

@@ -11,8 +11,6 @@
 namespace Serilog.Sinks.Grafana.Loki
 
 open System
-open System.Buffers
-open System.Text.Encodings.Web
 open System.Text.Json
 open Serilog.Events
 open Serilog.Formatting
@@ -31,12 +29,6 @@ type LokiJsonTextFormatter(exceptionFormatter: ILokiExceptionFormatter, enrichTr
     static let pTraceId = JsonEncodedText.Encode "TraceId"
     static let pSpanId = JsonEncodedText.Encode "SpanId"
 
-    // Relaxed escaping keeps the body readable: only JSON-mandatory escapes, non-ASCII verbatim.
-    // The default Utf8JsonWriter encoder is HTML-safe and would \uXXXX-escape every '"', '<', '>',
-    // '&', '\'' and all non-ASCII. Output stays valid JSON, so consumers are unaffected.
-    static let relaxedWriterOptions =
-        JsonWriterOptions(Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping)
-
     // Names that collide with top-level JSON keys; prefixed with '_' when seen as properties.
     static let reserved =
         Collections.Generic.HashSet<string>(
@@ -180,9 +172,7 @@ type LokiJsonTextFormatter(exceptionFormatter: ILokiExceptionFormatter, enrichTr
         use buffer = new PooledByteBufferWriter(256)
         // Throwaway writer + scratch for the message render. The internal sink path passes reused
         // instances instead; the public path stays allocation-light but fully thread-safe.
-        use jsonWriter =
-            new Utf8JsonWriter(buffer :> IBufferWriter<byte>, relaxedWriterOptions)
-
+        use jsonWriter = JsonWriterDefaults.createWriter buffer
         use messageBuffer = new PooledByteBufferWriter(128)
         use messageWriter = new Utf8TextWriter(messageBuffer)
         self.FormatToBuffer(logEvent, jsonWriter, messageWriter)

src/Serilog.Sinks.Grafana.Loki/Serialization.fs

@@ -16,22 +16,12 @@ open System
 open System.Buffers
 open System.Buffers.Text
 open System.Collections.Generic
-open System.Text.Encodings.Web
 open System.Text.Json
 open Microsoft.FSharp.NativeInterop
 open Serilog.Events
 open Serilog.Formatting
 open Serilog.Sinks.Grafana.Loki.Infrastructure
 
-/// Relaxed JSON escaping for the bytes the sink emits. The default Utf8JsonWriter encoder is
-/// HTML-safe and renders every '"', '<', '>', '&', '\'' and all non-ASCII as \uXXXX, which makes
-/// the stored log line unreadable; the relaxed encoder escapes only what JSON mandates and emits
-/// non-ASCII verbatim. Output stays valid JSON (and valid UTF-8), so consumers are unaffected.
-[<AutoOpen>]
-module private JsonWriterDefaults =
-    let relaxedWriterOptions =
-        JsonWriterOptions(Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping)
-
 /// Reusable per-sink serialization scratch: the buffers and writers reused across every batch
 /// (cleared/reset between uses), bundled so the serializer takes one value instead of several
 /// same-typed positional args (easy to mis-order), and disposed as a unit by the sink.
@@ -41,9 +31,7 @@ type internal SerializationBuffers() =
     let body = new PooledByteBufferWriter(256)
     let message = new PooledByteBufferWriter(256)
 
-    let bodyWriter =
-        new Utf8JsonWriter(body :> IBufferWriter<byte>, relaxedWriterOptions)
-
+    let bodyWriter = JsonWriterDefaults.createWriter body
     let messageWriter = new Utf8TextWriter(message)
 
     /// Envelope buffer holding the full push payload; read by LokiPushContent after serialize.
@@ -100,8 +88,7 @@ module internal Serialization =
             | :? LokiJsonTextFormatter as fmt when fmt.GetType() = typeof<LokiJsonTextFormatter> -> fmt
             | _ -> Unchecked.defaultof<LokiJsonTextFormatter>
 
-        use jsonWriter =
-            new Utf8JsonWriter(buffers.Main :> IBufferWriter<byte>, relaxedWriterOptions)
+        use jsonWriter = JsonWriterDefaults.createWriter buffers.Main
 
         // Reused stack scratch for the per-event Unix-nanosecond timestamp. Hoisted out of
         // the event loop so the localloc happens once per batch, not once per event. An

src/Serilog.Sinks.Grafana.Loki/Serilog.Sinks.Grafana.Loki.fsproj

@@ -48,6 +48,7 @@
         <!-- Infrastructure (no Serilog dependency) -->
         <Compile Include="Infrastructure\PooledByteBufferWriter.fs"/>
         <Compile Include="Infrastructure\Utf8TextWriter.fs"/>
+        <Compile Include="Infrastructure\JsonWriterDefaults.fs"/>
 
         <!-- Public contract types -->
         <Compile Include="LokiLabel.fs"/>

tests/Serilog.Sinks.Grafana.Loki.UnitTests/WireFormatTests.fs

@@ -257,17 +257,53 @@ let ``body: quotes, markup and non-ASCII are not unicode-escaped`` () : Task =
     task {
         let handler, sink = makeSink id
         use _ = sink
-        do! flush sink [ mkInfo [ "Note", box "a>b <c> & \"q\" Привет" ] ]
+        do! flush sink [ mkInfo [ "Note", box "a>b <c> & \"q\" café 日本語" ] ]
         use doc = handler.LastBodyJson
         let body = bodyStringOf (streamAt 0 doc) 0
         // Relaxed escaping: '<' '>' '&' and non-ASCII stay verbatim and quotes use the JSON-standard
         // \", never \uXXXX. The default HTML-safe encoder would render all of these as \uXXXX.
         test <@ body.Contains("a>b <c> &") @>
-        test <@ body.Contains("Привет") @>
+        test <@ body.Contains("café 日本語") @>
         test <@ body.Contains("\\\"q\\\"") @>
         test <@ not (body.Contains("\\u0022")) @>
     }
 
+[<Fact>]
+let ``body: public Format path keeps quotes, markup and non-ASCII readable`` () =
+    // The sink fast path calls FormatToBuffer directly; this is the only coverage of the public
+    // ITextFormatter.Format entry point, whose Utf8JsonWriter is a separate construction site.
+    let formatter = LokiJsonTextFormatter() :> ITextFormatter
+    let event = mkInfo [ "Note", box "a>b <c> & \"q\" café 日本語" ]
+    use output = new System.IO.StringWriter()
+    formatter.Format(event, output)
+    let body = output.ToString()
+    use _ = JsonDocument.Parse(body) // output must stay valid JSON
+    test <@ body.Contains("a>b <c> &") @>
+    test <@ body.Contains("café 日本語") @>
+    test <@ body.Contains("\\\"q\\\"") @>
+    test <@ not (body.Contains("\\u")) @>
+
+[<Fact>]
+let ``labels: promoted label value keeps markup and non-ASCII verbatim`` () : Task =
+    task {
+        let handler, sink =
+            makeSink (fun o ->
+                { o with
+                    PropertiesAsLabels = [| "app" |]
+                })
+
+        use _ = sink
+        do! flush sink [ mkInfo [ "app", box "<svc> café 日本語" ] ]
+        use doc = handler.LastBodyJson
+        let raw = handler.LastBodyText
+        // The envelope writer escapes label keys/values too. The round-trip proves the label
+        // decodes back to the original; the raw scan proves it ships verbatim, not \uXXXX (a
+        // label-only regression would still decode correctly but leak escaped < or non-ASCII bytes).
+        test <@ labelOf "app" (streamAt 0 doc) = Some "<svc> café 日本語" @>
+        test <@ raw.Contains("<svc> café 日本語") @>
+        test <@ not (raw.Contains("\\u")) @>
+    }
+
 [<Fact>]
 let ``body: reserved property "Message" sanitized to "_Message"`` () : Task =
     task {